Differences

This shows you the differences between two versions of the page.

--- tips:irix:security [2026/10/02 09:39] – [Secure inetd] mattieu
+++ tips:irix:security [2026/10/02 14:27] (current) – mattieu
@@ Line 24: / Line 24: @@
         noiconlogin          off
         nostickytmp          off
+        pmcd                 off
         pmie                 off
         proclaim_relayagent  off
@@ Line 33: / Line 34: @@
         routed               off
         rsvpd                off
+        rtmond               off
         rwhod                off
         sar                  off
@@ Line 65: / Line 67: @@
         nsd                  on
         ntp                  on
-        pmcd                 on
         privileges           on
-        rtmond               on
         savecore             on
         sendmail             on
@@ Line 96: / Line 96: @@
 # killall -HUP inetd
 </code>
+===== Improve kernel security =====
+Add a bit of entropy to the TCP sequence number and drop ICMP redirects:
+<code>
+# systune ipforwarding 0
+# systune ip6forwarding 0
+# systune tcpiss_md5 1
+# systune icmp_dropredirects 1
+# systune restricted_chown 1
+# systune allow_brdaddr_srcaddr 0
+# systune tcp_2msl 60
+</code>
+These kernel settings can be found in the /var/sysgen/stune file.
+Finally:
+<code>
+# autoconfig -vf
+# reboot
+</code>
+===== Make sendmail just listen on localhost =====
+Edit /etc/mail/sendmail.mc. Switch the two lines to be:
+<code>
+DAEMON_OPTIONS(`Name=MTA-v4,Family=inet,Addr=127.0.0.1')dnl
+dnl DAEMON_OPTIONS(`Name=MTA-v6,Family=inet6')dnl
+</code>
+Then run configmail to update sendmail.cf and restart it:
+<code>
+# configmail mc2cf
+# /etc/init.d/mail restart
+</code>
+~~NOTOC~~